# PhishDestroy domain threat record: bitcoincodes.digital

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bitcoincodes.digital/
Machine-readable companion: https://phishdestroy.io/domain/bitcoincodes.digital/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 05:18:15 UTC
- Last availability or vendor check: 2026-10-23 05:50:36 UTC
- Stored record updated: 2026-10-23 06:30:31 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Bitcoin

## Stored infrastructure

- Observed IP address: 185.62.56.63
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200
- Registration date (registry RDAP, bitcoincodes.digital): 2026-04-09 11:51:16 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1674d-ce79-708d-9c2f-9486131cc514/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bitcoincodes.digital
- Certificate Transparency search: https://crt.sh/?q=%25.bitcoincodes.digital
- Web Archive lookup: https://web.archive.org/web/*/https://bitcoincodes.digital/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake system classified bitcoincodes.digital as malicious because VirusTotal reported a single phishing detection for the domain. The recorded page title “Bitcoin codes | AI Trading Platform | Official Website” and the excerpt describing an AI‑driven trading service that promises reliable outcomes while requesting name, email and phone number match the risk signals for fraudulent investment schemes. The domain was first seen by PhishDestroy on 2026-10-23 and returned an HTTP 200 response at that time.

How the scam works
Fraudulent AI‑trading schemes lure victims by claiming automated bots can generate consistent cryptocurrency profits, then demand personal details or payment to unlock the service. The collected information is typically used for phishing, identity theft, or to solicit funds that never produce the advertised returns. Victims are often persuaded to trust the polished marketing copy and may be directed to send money to untraceable accounts.

Evidence
VirusTotal’s analysis on 2026-10-20 recorded one malicious detection from SOCRadar labeling the domain as phishing. Google Safe Browsing checked on 2026-10-23 did not flag the site. urlscan.io captured the site on 2026-08-07; its overall verdict was clean but its engine flagged the URL as malicious with a score of 98. Cloudflare Radar scanned the domain on 2026-10-23 and returned a malicious verdict under the malware category, also marking it as phishing; OTX listed one pulse and PhishDestroy’s internal blocklist includes the domain while external blocklists reported none on the check date.

Infrastructure
The domain was registered on 2026-04-09 through Spaceship, Inc., giving it an age of 197 days at first sighting. The recorded IP address was 185.62.56.63, associated with Snel.com B.V. in the Netherlands, and the domain used Cloudflare nameservers dave.ns.cloudflare.com and hazel.ns.cloudflare.com. The TLS certificate observed on 2026-10-05 was issued by ZeroSSL ECC DV and was valid until 2027-01-03.

What to do
Visitors should not submit personal or financial information to the site; if they have already done so, they should monitor related accounts for suspicious activity and change passwords where applicable. Organizations should add bitcoincodes.digital to web‑filtering and intrusion‑detection rules and review logs for connections to the recorded IP address 185.62.56.63. No wallet‑related remediation is needed because the site does not request cryptocurrency addresses or private keys.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019fdaef-76b8-7396-b0e1-7faebae1b7e8/
Cloudflare Radar report: https://radar.cloudflare.com/scan/db8a6993-ab3d-4a36-b92f-d177ddc475ee
Stored capture screenshot: https://urlscan.io/screenshots/019fdaef-76b8-7396-b0e1-7faebae1b7e8.png
Cloudflare Radar screenshot (2026-10-23T05:33:34Z): https://screenshots.phishdestroy.io/cf/db8a6993-ab3d-4a36-b92f-d177ddc475ee.png
URLScan screenshot (2026-08-06T05:15:53Z): https://screenshots.phishdestroy.io/us/019fd57f-4c4d-7378-b034-0c29043fa188.png
URLScan capture report: https://urlscan.io/result/019fd57f-4c4d-7378-b034-0c29043fa188/
URLScan screenshot (2026-08-06T07:51:19Z): https://screenshots.phishdestroy.io/us/019fd60d-9ad6-7548-81dd-19ca0c2ac1bb.png
URLScan capture report: https://urlscan.io/result/019fd60d-9ad6-7548-81dd-19ca0c2ac1bb/
URLScan screenshot (2026-10-23T05:33:30Z): https://screenshots.phishdestroy.io/us/01a1673f-d79b-7580-a440-614e7d08c97b.png
URLScan capture report: https://urlscan.io/result/01a1673f-d79b-7580-a440-614e7d08c97b/
URLScan screenshot (2026-10-23T05:39:00Z): https://screenshots.phishdestroy.io/us/01a16744-e080-724a-8b22-16dd7bc43461.png
URLScan capture report: https://urlscan.io/result/01a16744-e080-724a-8b22-16dd7bc43461/
VirusTotal report: https://www.virustotal.com/gui/domain/bitcoincodes.digital
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bitcoincodes.digital
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 05:39:59 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1674d-ce79-708d-9c2f-9486131cc514.png
  Captured: 2026-10-23 05:50:36 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019fdaef-76b8-7396-b0e1-7faebae1b7e8.png
  Captured: 2026-10-23 05:18:15 UTC
  Source report: https://urlscan.io/result/01a1674d-ce79-708d-9c2f-9486131cc514/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/db8a6993-ab3d-4a36-b92f-d177ddc475ee.png
  Captured: 2026-10-23 05:33:34 UTC
  Source report: https://radar.cloudflare.com/scan/db8a6993-ab3d-4a36-b92f-d177ddc475ee
  SHA-256: 47a5e5b247092bde95f7ef5af5a79e117d6689a96f93a882146e71a11a1540b6
- URLQuery: https://screenshots.phishdestroy.io/uq/46f3f21b-7c84-4853-ba7e-3c424f5984e0.png
  Source report: https://urlquery.net/report/46f3f21b-7c84-4853-ba7e-3c424f5984e0
  SHA-256: 8d10cabdba5de68fa734184309eaac6b0955c054a61bccc6b0ddfbad5ba3f8b1
- URLScan · 2026-08-06: https://screenshots.phishdestroy.io/us/019fd57f-4c4d-7378-b034-0c29043fa188.png
  Captured: 2026-08-06 05:15:53 UTC
  Source report: https://urlscan.io/result/019fd57f-4c4d-7378-b034-0c29043fa188/
  SHA-256: bdbc4c15e99c9fcab9a14ba076bcb660ac6c4d6ab4deeabd9d55cc953a5b5bc1
- URLScan · 2026-08-06: https://screenshots.phishdestroy.io/us/019fd60d-9ad6-7548-81dd-19ca0c2ac1bb.png
  Captured: 2026-08-06 07:51:19 UTC
  Source report: https://urlscan.io/result/019fd60d-9ad6-7548-81dd-19ca0c2ac1bb/
  SHA-256: 8942ac41f725b1d72d28392283e9d4b7996b5edae035b3255443de33c04f3aad
- URLScan · 2026-08-07: https://screenshots.phishdestroy.io/us/019fdaef-76b8-7396-b0e1-7faebae1b7e8.png
  Captured: 2026-08-07 06:36:00 UTC
  Source report: https://urlscan.io/result/019fdaef-76b8-7396-b0e1-7faebae1b7e8/
  SHA-256: 806f3af3ce786d9fea130efb3c9e53483edd6bf500e4e0a7d41724757e959ca2
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a1673f-d79b-7580-a440-614e7d08c97b.png
  Captured: 2026-10-23 05:33:30 UTC
  Source report: https://urlscan.io/result/01a1673f-d79b-7580-a440-614e7d08c97b/
  SHA-256: 11714cc8881a93e7b8a65b5939be7e994fd3ff9b75658aaec31a7d82a778605f
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16744-e080-724a-8b22-16dd7bc43461.png
  Captured: 2026-10-23 05:39:00 UTC
  Source report: https://urlscan.io/result/01a16744-e080-724a-8b22-16dd7bc43461/
  SHA-256: e935da9546d584b1979847d0cbc09418b70b8834a8ffd5f55e0e24214efa6ba1

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T07:54:05Z",
        "uuid": "01a1674d-ce79-708d-9c2f-9486131cc514",
        "scanned_at": "2026-10-23T05:48:45Z",
        "final_url": "https://bitcoincodes.digital/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://bitcoincodes.digital/",
                "from": "http://bitcoincodes.digital/",
                "status": 307
            }
        ],
        "ip": "185.62.56.63",
        "ptr": "s46060.hosted-by-snel.com",
        "domains": [
            "cdn.jsdelivr.net",
            "challenges.cloudflare.com",
            "fonts.gstatic.com",
            "www.cloudflare.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "104.18.94.41",
            "142.251.20.94",
            "104.18.95.41",
            "104.16.123.96",
            "104.17.207.5",
            "192.178.183.95",
            "185.62.56.63"
        ],
        "asns": [
            "13335",
            "15169",
            "62370"
        ],
        "countries": [
            "US",
            "NL"
        ],
        "doc_hash": "0aa8fdb9b79083997aa5c2b648c10bcbf7c48ff5e07a2197119549b12fde3405",
        "script_hashes": [
            "43b94ad299935fafb576f0ca68160ba608cb50c5ec73f50cec13fb805ab95f31"
        ],
        "globals": [
            "toggleTermsPopup",
            "intlTelInput",
            "__TS_SITEKEY",
            "__tsGet",
            "__tsReset",
            "__tsNeedsClick",
            "__tsShow",
            "__lgBS",
            "__visitorCountry",
            "ClientJS",
            "turnstile"
        ],
        "storage_keys": [
            "t_cfp"
        ],
        "tls": {
            "san": [
                "bitcoincodes.digital"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "ZeroSSL ECC DV SSL CA 2",
            "subject": "bitcoincodes.digital",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-03T23:59:59Z",
            "valid_from": "2026-10-05T00:00:00Z"
        },
        "domain_age_days": 196,
        "apex_age_days": 196,
        "tls_age_days": 18,
        "tls_valid_days": 90,
        "requests": 21,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "referrer-policy": "no-referrer-when-downgrade"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T05:39:13Z",
        "uuid": "db8a6993-ab3d-4a36-b92f-d177ddc475ee",
        "scanned_at": "2026-10-23T05:33:34Z",
        "final_url": "https://bitcoincodes.digital/",
        "status": 200,
        "history": [
            {
                "url": "https://bitcoincodes.digital/",
                "status": 200
            }
        ],
        "dom_hash": "c2e6628875e3281a250a8ff308ead31971fc8d9e07591b92664cda443c3f18a0",
        "doc_hash": "bf9d3506a638a5cf84303e84e3677c835571e49279d0f1b175d97f19600d504c",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bitcoincodes.digital",
                "type": "A",
                "value": "185.62.56.63"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.62.56.63",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-04-09T11:51:16Z",
            "updated": "2026-08-11T19:23:12Z",
            "expires": "2027-04-09T11:51:16Z",
            "nameservers": [
                "dave.ns.cloudflare.com",
                "hazel.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T05:32:05Z",
        "analysis_at": "2026-10-20T11:25:43Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 35
        },
        "detections": {
            "SOCRadar": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-04-09T12:25:55Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "185.62.56.63"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dave.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "hazel.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "dave.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-20T11:33:22Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "bitcoincodes.digital"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "cc3320306cb2aff95b570a12bd2bed41",
            "sha256": "84b4f6116b89f8764d49551c995de66cbc14ea321a0150990960dd06bd18956c",
            "subject": "bitcoincodes.digital",
            "valid_to": "2027-01-03T23:59:59Z",
            "valid_from": "2026-10-05T00:00:00Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-08-20T20:13:31Z",
                "registration": "2026-04-09T11:51:16Z",
                "registrar expiration": "2027-04-09T11:51:16Z",
                "last update of RDAP database": "2026-10-16T03:34:18Z"
            },
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T05:39:31Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "bitcoincodes.digital"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-23T05:22:59Z",
            "first": "2026-10-16T02:27:40Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.14,
            "avg_page_bytes": 12082
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://bitcoincodes.digital/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "title": "Bitcoin codes | AI Trading Platform | Official Website",
            "themeColor": "#061310",
            "description": "Bitcoin codes delivers a premium, AI-powered trading platform overview, featuring automated bots, intelligent workflows, and risk-aware automation across multiple assets.",
            "canonicalUrl": "https://bitcoincodes.digital/"
        },
        "trackers": {
            "requests": 18,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 3
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.jsdelivr.net/npm/intl-tel-input@23/build/js/intlTelInput.min.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 29,
                "wait": 35,
                "connect": 24,
                "download": 21
            },
            "response_ms": 111
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "ocsp_stapled": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 41658,
            "co2_grams": 0.0015,
            "cleaner_than": 41
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.193.109",
                    "host": "dave.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.34.157",
                    "host": "hazel.ns.cloudflare.com"
                }
            ],
            "zone": "bitcoincodes.digital"
        },
        "location": {
            "ip": "185.62.56.63",
            "asn": "62370",
            "org": "Snel.com B.V.",
            "city": "Schiedam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "subject": "bitcoincodes.digital"
        },
        "dns": {
            "A": [
                "185.62.56.63"
            ],
            "NS": [
                "hazel.ns.cloudflare.com",
                "dave.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"dave.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416601321, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "no-referrer-when-downgrade",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "185.62.56.63",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://bitcoincodes.digital"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare Turnstile",
                "ClientJS",
                "Priority Hints",
                "jsDelivr",
                "Google Font API",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 38
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "referrer-policy": "no-referrer-when-downgrade"
            }
        }
    }
}
```